From c23e95a9e2204a5b7701429dde74ca9e87e801c8 Mon Sep 17 00:00:00 2001
From: macneiln <macneil_n@hotmail.com>
Date: Mon, 7 Sep 2020 19:55:59 +1200
Subject: [PATCH] Add hash_extension functionality

Add hash_extension functionality so _signature can be verified regardless of the extension.
---
 gluon/html.py | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/gluon/html.py b/gluon/html.py
index b4d597fd..9b8b52b0 100644
--- a/gluon/html.py
+++ b/gluon/html.py
@@ -190,7 +190,8 @@ def URL(a=None,
         port=None,
         encode_embedded_slash=False,
         url_encode=True,
-        language=None
+        language=None,
+        hash_extension=True
         ):
     """
     generates a url '/a/c/f' corresponding to application a, controller c
@@ -339,7 +340,8 @@ def URL(a=None,
         if '.' in function:
             function, extension = function.rsplit('.', 1)
 
-    function2 = '%s.%s' % (function, extension or 'html')
+    # only include the extension as part of the variables for the hash if requested
+    function2 = '%s.%s' % (function, extension or 'html') if hash_extension else function
 
     if not (application and controller and function):
         raise SyntaxError('not enough information to build the url (%s %s %s)' % (application, controller, function))
@@ -416,7 +418,7 @@ def URL(a=None,
     return url
 
 
-def verifyURL(request, hmac_key=None, hash_vars=True, salt=None, user_signature=None):
+def verifyURL(request, hmac_key=None, hash_vars=True, salt=None, user_signature=None, hash_extension=True):
     """
     Verifies that a request's args & vars have not been tampered with by the user
 
@@ -477,10 +479,19 @@ def verifyURL(request, hmac_key=None, hash_vars=True, salt=None, user_signature=
 
     # always include all of the args
     other = args and urllib_quote('/' + '/'.join([str(x) for x in args])) or ''
+    
+    # decide whether the extension should be part of the hash verification
+    h_extension = request.extension if hash_extension else ''
+
+    # only add a period to the extension when it exists otherwise empty
+    # extensions will fail to validate
+    if h_extension:
+        h_extension = '.%s' % (h_extension)
+        
     h_args = '/%s/%s/%s.%s%s' % (request.application,
                                  request.controller,
                                  request.function,
-                                 request.extension,
+                                 h_extension,
                                  other)
 
     # but only include those vars specified (allows more flexibility for use with